External indexer disconnected due to certificates expiry (4368875)

External indexer disconnected due to certificates expiry

Symptoms: 
External indexers are disconnected and throw the following errors:

indexerworker[3042845]: LogID:183 core.network(1): Fatal error during SSL handshake; error='"The issuer certificate of a locally looked up certificate could not be found"'
indexerworker[3042845]: LogID:183 core.network(1): Fatal error during SSL handshake; error='"No certificates could be verified"'
indexerworker[3042845]: LogID:183 core.network(1): Fatal error during SSL handshake; error='"The certificate has expired"'
indexerworker[3042845]: LogID:176 core.network(1): Connection error; error='QAbstractSocket::SocketError(13)'
indexerworker[3042845]: LogID:217 communicator(3): Socket error, exiting after 10 seconds; error='QAbstractSocket::SocketError(13)'
indexerworker[3042845]: LogID:125 processor(3): Abort processing
 
Who is impacted:
You are only affected by this issue if you have enabled external indexing while running SPS version 6.0.4 or 6.4.0 or later where the external indexer certificates were created with a limit of 800 days.
 

WORKAROUND:
Reconfigure the external indexers to issue new certificates:
1. Disable external indexing by unchecking Basic Settings > Local services > Enable remote indexing. 
- This will show a warning and will stop all currently running indexing jobs. 
- These jobs will be retried later, no data loss is expected.

2. Enable remote indexing again. 
- This will recreate the external indexer configuration and issue a new certificate.

3. Distribute the updated configuration to the external indexers and update these configs with the 'indexer-box-config' script. Please refer to the Admin guide link for more details on configuring the external indexer HERE

Note: until SPS version 7.0.1 LTS & 7.1 feature release is available, the refreshed certificates will have a lifetime of 800 days. After upgrading to version 7.0.1 LTS & 7.1 feature release, the refreshed certificates will be valid for 20 years.


RESOLUTION:
Change Request # PAM-16883 will fix the issue where certificates issued for external indexer will again have a lifetime of 20 years. This fix will be included in SPS version 7.0.1 LTS and 7.1 Feature release.

Once available and after upgrading to the fixed release versions above you will still need to reconfigure the external indexers by disabling and re-enabling external indexing and resetting the external indexer configurations which will create new certificates with a lifetime of 20 years.
 

PAM-16883